Fix CVE-2026-41991 and CVE-2026-41992
Resolves: RHEL-215648 Resolves: RHEL-233024
This commit is contained in:
Jakub Martisko
parent
25d8240d04
commit
0eaf31f4a1
54
CVE-2026-41991.patch
Normal file
54
CVE-2026-41991.patch
Normal file
@ -0,0 +1,54 @@
|
||||
From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Thu, 16 Apr 2026 12:11:44 -0700
|
||||
Subject: gzexe: use -C if lacking mktemp
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
(Problem reported by Michał Majchrowicz.)
|
||||
* gzexe.in: If mktemp is needed but not installed,
|
||||
use ‘set -C’ to avoid a race when creating a temporary file.
|
||||
* zdiff.in: Use the same pattern here, even though the old
|
||||
code was probably OK anyway.
|
||||
---
|
||||
NEWS | 5 +++++
|
||||
gzexe.in | 1 +
|
||||
zdiff.in | 7 +++----
|
||||
3 files changed, 9 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/gzexe.in b/gzexe.in
|
||||
index ea4ef94..f3d46cc 100644
|
||||
--- a/gzexe.in
|
||||
+++ b/gzexe.in
|
||||
@@ -127,6 +127,7 @@ for i do
|
||||
tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
|
||||
else
|
||||
tmp=${dir}gzexe$$
|
||||
+ (umask 77; set -C; > "$tmp")
|
||||
fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
|
||||
res=$?
|
||||
printf >&2 '%s\n' "$0: cannot copy $file"
|
||||
diff --git a/zdiff.in b/zdiff.in
|
||||
index 289e466..53266df 100644
|
||||
--- a/zdiff.in
|
||||
+++ b/zdiff.in
|
||||
@@ -156,12 +156,11 @@ case $file2 in
|
||||
*) TMPDIR=/tmp/;;
|
||||
esac
|
||||
if type mktemp >/dev/null 2>&1; then
|
||||
- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
|
||||
- exit 2
|
||||
+ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
|
||||
else
|
||||
- set -C
|
||||
tmp=${TMPDIR}zdiff$$
|
||||
- fi
|
||||
+ (umask 77; set -C; > "$tmp")
|
||||
+ fi &&
|
||||
'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
|
||||
gzip_status=$(
|
||||
exec 4>&1
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
36
CVE-2026-41992.patch
Normal file
36
CVE-2026-41992.patch
Normal file
@ -0,0 +1,36 @@
|
||||
From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Wed, 15 Apr 2026 12:00:17 -0700
|
||||
Subject: gzip: don’t mishandle .lzh after .Z
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Problem reported by Michał Majchrowicz.
|
||||
* unlzh.c (read_c_len): Clear left and right when n == 0.
|
||||
---
|
||||
NEWS | 4 ++++
|
||||
THANKS | 1 +
|
||||
unlzh.c | 6 ++++++
|
||||
3 files changed, 11 insertions(+)
|
||||
|
||||
diff --git a/unlzh.c b/unlzh.c
|
||||
index 2522764..c3e92ff 100644
|
||||
--- a/unlzh.c
|
||||
+++ b/unlzh.c
|
||||
@@ -313,6 +307,12 @@ decode_p ()
|
||||
|
||||
local void huf_decode_start()
|
||||
{
|
||||
+ /* Needed in case LEFT and RIGHT are reused from a previous
|
||||
+ LZW decompression. It may be overkill to clear all of both
|
||||
+ arrays, but nobody has had time to analyze this carefully. */
|
||||
+ memzero (left, (2 * NC - 1) * sizeof *left);
|
||||
+ memzero (right, (2 * NC - 1) * sizeof *right);
|
||||
+
|
||||
init_getbits(); blocksize = 0;
|
||||
}
|
||||
|
||||
--
|
||||
cgit v1.3
|
||||
|
||||
20
gzip.spec
20
gzip.spec
@ -1,7 +1,7 @@
|
||||
Summary: The GNU data compression program
|
||||
Name: gzip
|
||||
Version: 1.12
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
# info pages are under GFDL license
|
||||
License: GPLv3+ and GFDL
|
||||
Source0: http://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
|
||||
@ -11,8 +11,16 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt
|
||||
Source100: colorzgrep.csh
|
||||
Source101: colorzgrep.sh
|
||||
|
||||
Patch1: gnulib.patch
|
||||
#Patch1: gnulib.patch
|
||||
Patch2: gzexe.patch
|
||||
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
|
||||
Patch3: CVE-2026-41991.patch
|
||||
# Regarding the following two links:
|
||||
# The second one reverts the first one and then applies the changes,
|
||||
# since the first one is not being used here, the reverting part has been removed
|
||||
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
|
||||
#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
|
||||
Patch4: CVE-2026-41992.patch
|
||||
|
||||
# Fixed in upstream code.
|
||||
# http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
|
||||
@ -42,6 +50,8 @@ very commonly used data compression program.
|
||||
%setup -q
|
||||
#%patch1 -p1 -b .gnulib
|
||||
%patch2 -p1 -b .gzexe
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
cp %{SOURCE1} .
|
||||
autoreconf
|
||||
|
||||
@ -90,6 +100,12 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
|
||||
%{profiledir}/*
|
||||
|
||||
%changelog
|
||||
* Fri Aug 14 2026 Jakub Martisko <jamartis@redhat.com> - 1.12-2
|
||||
- Fix an issue with a temporary file creations when mktemp is missing (41991)
|
||||
- Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)
|
||||
Resolves: CVE-2026-41991
|
||||
Resolves: CVE-2026-41992
|
||||
|
||||
* Fri Apr 22 2022 Jakub Martisko <jamartis@redhat.com> - 1.12-1
|
||||
- Rebase to gzip 1.12
|
||||
- Resolves an arbitrary-file-write vulnerability in zgrep
|
||||
|
||||
Loading…
Reference in New Issue
Block a user